Security readout for executives and security teams
Plain-English summary
CVE-2021-0641 is an Android information disclosure flaw. A local app could access unique subscription-related identifiers because Android missed a required permission check. It affects Android 8.1, 9, 10, and 11. The issue is privacy-relevant rather than system-takeover: the cited impact is disclosure of sensitive identifiers, not code execution or service disruption.
Executive priority
Treat this as a moderate privacy and compliance exposure. It is not described as remote compromise, but it can expose unique identifiers from affected Android devices. Prioritize patching managed Android fleets and reducing untrusted app exposure, especially where device identifiers are sensitive.
Technical view
The flaw is in getAvailableSubscriptionInfoList in SubscriptionController.java. It is classified as CWE-862, missing authorization. CVSS 3.1 is 5.5: local access, low complexity, low privileges, no user interaction, high confidentiality impact, no integrity or availability impact. Android ID A-185235454 tracks the issue.
Likely exposure
Exposure is limited to Android 8.1 through Android 11 devices that have not received the relevant Android or OEM security update. Risk is higher on managed fleets allowing untrusted local apps, BYOD devices, or apps with access near telephony/subscription workflows.
Exploitation context
The provided sources do not report active exploitation, and KEV status is false. Exploitation is local, requires a low-privileged app or local user context, and needs no user interaction. Sources do not provide exploit details, observed attacks, or abuse prevalence.
Researcher notes
Evidence is concise and does not name a standalone workaround. The vulnerability is a permission-check failure in Android telephony subscription handling. Validation should focus on affected OS versions, bulletin coverage, OEM patch delivery, and whether local app installation risk is controlled.
Mitigation direction
- Inventory Android 8.1, 9, 10, and 11 devices.
- Check Android and OEM guidance for the August 2021 security bulletin.
- Apply available vendor or carrier security updates to affected devices.
- Restrict installation of untrusted apps on unpatched managed devices.
- Retire or isolate devices that can no longer receive security updates.
Validation and detection
- Confirm each device Android version and security patch level.
- Compare fleet patch status against the August 2021 Android bulletin.
- Use MDM reporting to identify affected unpatched Android versions.
- Review app installation policy for untrusted local apps.
- Document exceptions for devices without OEM update availability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-0641 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://source.android.com/security/bulletin/2021-08-01CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.